Web Security & HTTP ReferenceUpdated: 2026-11-06

Cross-Origin Resource Sharing (CORS) & OWASP Security Headers Reference

Quick reference for Access-Control headers, preflight OPTIONS caching, Content Security Policy (CSP), and HSTS.

HTTP headers are the frontline defense of modern web applications. Understanding Cross-Origin Resource Sharing (CORS) headers and OWASP security headers prevents cross-site data theft, clickjacking, MIME-type sniffing, and man-in-the-middle attacks.

Core CORS Server Response Headers OWASP Recommended HTTP Security Headers

Core CORS Server Response Headers

Headers returned by API servers to permit cross-origin access in web browsers.

Header Name	Accepted Values	Security Implication
`Access-Control-Allow-Origin`	`https://example.com` or `*`	Never use `*` on authenticated APIs that process user cookies or Bearer tokens.
`Access-Control-Allow-Methods`	`GET, POST, PUT, DELETE, OPTIONS`	Restricts permitted HTTP verbs on the target resource endpoint.
`Access-Control-Allow-Headers`	`Content-Type, Authorization, X-Api-Key`	Allows client to send non-standard HTTP request headers.
`Access-Control-Allow-Credentials`	`true`	Required when requests include cookies or Authorization headers. Incompatible with `*` origin.
`Access-Control-Max-Age`	`86400` (Seconds)	Caches preflight OPTIONS check in browser, eliminating latency on subsequent API calls.

OWASP Recommended HTTP Security Headers

Mandatory defensive headers for production web apps.

Header Name	Recommended Production Directive	Protection Target
`Content-Security-Policy`	`default-src 'self'; img-src 'self' https: data:`	Prevents Cross-Site Scripting (XSS) and unauthorized data exfiltration
`Strict-Transport-Security`	`max-age=63072000; includeSubDomains; preload`	Enforces HTTPS encryption and prevents SSL-stripping MITM attacks
`X-Content-Type-Options`	`nosniff`	Blocks browsers from sniffing MIME types away from declared Content-Type
`X-Frame-Options`	`DENY` or `SAMEORIGIN`	Protects users against Clickjacking attacks via unauthorized `<iframe>` embedding
`Referrer-Policy`	`strict-origin-when-cross-origin`	Protects private URL tokens and query parameters from leaking to external referrers

Interactive Client-Side Tools for this Guide

Test and run these patterns directly inside your browser with zero server uploads:

Webhook HMAC Signature Generator & Verifier

Cryptographically sign and verify incoming webhook payloads with your secret key. Supports Stripe, GitHub, and Shopify standards with zero server uploads.

Open Tool

Online Hash Generator (MD5, SHA-256, SHA-512)

Compute message digests and cryptographic checksums using native Web Crypto API. 100% private and client-side.

Open Tool

Frequently Asked Questions

Why does Access-Control-Max-Age not cache for more than 2 hours in Chrome?

While the HTTP specification allows any duration, Chromium caps Access-Control-Max-Age at 7200 seconds (2 hours) for security reasons, while Firefox caps it at 86400 seconds (24 hours).

What is the purpose of the Permissions-Policy header?

`Permissions-Policy` (formerly Feature-Policy) allows website administrators to explicitly disable browser hardware APIs like `camera=(), microphone=(), geolocation=()` to protect user privacy against rogue third-party scripts.

Back to All Cheat Sheets